Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2024 11:24

General

  • Target

    Open AI Sora Vesion 5.42.exe

  • Size

    157.9MB

  • MD5

    167af794837fe9de07ee83acdb74343e

  • SHA1

    a3f718d502a0f9e8382d12da9704433b96ea53ed

  • SHA256

    06c81d76f89cd374efcf4140b1f8239f30a89b1132608c3696e64199c9d9bd0c

  • SHA512

    8e78779a4d43604e705335c45569137ddc0b8b5448d15c44c1bb0fae59c95457dfa896bb3671aec79a0082f104ffa61182453218f759669320b9cba909c0d588

  • SSDEEP

    1572864:FHMlnmXXHfarJ2MH6rd07/eGpQvyLxCi70QzyhpPc2qfF4SagVnhqODQA86:NInmXXHfatH6dg/eiZzwJgFo

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Open AI Sora Vesion 5.42.exe
    "C:\Users\Admin\AppData\Local\Temp\Open AI Sora Vesion 5.42.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Stop-Process -Name "firefox"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1288
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Stop-Process -Name "firefox"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2220
    • C:\Users\Admin\AppData\Local\Public Program\Chrome Service.exe
      "C:\Users\Admin\AppData\Local\Public Program\Chrome Service.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1308

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    f188e3bc1f56233ad66940e065992430

    SHA1

    101c070894ff5b44cbf1edeacde3493fae3db702

    SHA256

    a06622be12871746dd7b3fa4118c97321e3c3efaabd9533c7085b2dbba6a44bd

    SHA512

    6da9917fea7503a6b777452b459fcdcfae60a80ef047858ddadebb9079bc9134424ad2bd55073c8be5dd1cd86aa3ef5572528e8ca0d67301c95eb15f0062325b

  • memory/1288-144-0x0000000072DC1000-0x0000000072DC2000-memory.dmp

    Filesize

    4KB

  • memory/1288-149-0x0000000072DC0000-0x000000007336B000-memory.dmp

    Filesize

    5.7MB

  • memory/1288-147-0x0000000072DC0000-0x000000007336B000-memory.dmp

    Filesize

    5.7MB

  • memory/1288-148-0x0000000072DC0000-0x000000007336B000-memory.dmp

    Filesize

    5.7MB

  • memory/1288-146-0x0000000072DC0000-0x000000007336B000-memory.dmp

    Filesize

    5.7MB

  • memory/1288-145-0x0000000072DC0000-0x000000007336B000-memory.dmp

    Filesize

    5.7MB

  • memory/2384-61-0x00000000062B0000-0x00000000062C2000-memory.dmp

    Filesize

    72KB

  • memory/2384-40-0x0000000005E70000-0x0000000005E81000-memory.dmp

    Filesize

    68KB

  • memory/2384-20-0x0000000009090000-0x000000000921E000-memory.dmp

    Filesize

    1.6MB

  • memory/2384-28-0x0000000009580000-0x00000000098D6000-memory.dmp

    Filesize

    3.3MB

  • memory/2384-53-0x0000000008FA0000-0x000000000901A000-memory.dmp

    Filesize

    488KB

  • memory/2384-25-0x0000000009580000-0x00000000098D6000-memory.dmp

    Filesize

    3.3MB

  • memory/2384-60-0x0000000006270000-0x00000000062AC000-memory.dmp

    Filesize

    240KB

  • memory/2384-57-0x0000000006270000-0x00000000062AC000-memory.dmp

    Filesize

    240KB

  • memory/2384-56-0x0000000008FA0000-0x000000000901A000-memory.dmp

    Filesize

    488KB

  • memory/2384-52-0x0000000009220000-0x00000000092B6000-memory.dmp

    Filesize

    600KB

  • memory/2384-49-0x0000000009220000-0x00000000092B6000-memory.dmp

    Filesize

    600KB

  • memory/2384-48-0x0000000006690000-0x00000000066E4000-memory.dmp

    Filesize

    336KB

  • memory/2384-45-0x0000000006690000-0x00000000066E4000-memory.dmp

    Filesize

    336KB

  • memory/2384-0-0x0000000006750000-0x00000000070D9000-memory.dmp

    Filesize

    9.5MB

  • memory/2384-64-0x00000000062B0000-0x00000000062C2000-memory.dmp

    Filesize

    72KB

  • memory/2384-44-0x00000000062F0000-0x0000000006365000-memory.dmp

    Filesize

    468KB

  • memory/2384-41-0x00000000062F0000-0x0000000006365000-memory.dmp

    Filesize

    468KB

  • memory/2384-13-0x0000000000700000-0x0000000000728000-memory.dmp

    Filesize

    160KB

  • memory/2384-37-0x0000000005E70000-0x0000000005E81000-memory.dmp

    Filesize

    68KB

  • memory/2384-36-0x0000000005EC0000-0x0000000005ED5000-memory.dmp

    Filesize

    84KB

  • memory/2384-33-0x0000000005EC0000-0x0000000005ED5000-memory.dmp

    Filesize

    84KB

  • memory/2384-32-0x0000000008EF0000-0x0000000008F95000-memory.dmp

    Filesize

    660KB

  • memory/2384-29-0x0000000008EF0000-0x0000000008F95000-memory.dmp

    Filesize

    660KB

  • memory/2384-24-0x0000000005E90000-0x0000000005EC0000-memory.dmp

    Filesize

    192KB

  • memory/2384-21-0x0000000005E90000-0x0000000005EC0000-memory.dmp

    Filesize

    192KB

  • memory/2384-17-0x0000000009090000-0x000000000921E000-memory.dmp

    Filesize

    1.6MB

  • memory/2384-16-0x0000000000700000-0x0000000000728000-memory.dmp

    Filesize

    160KB

  • memory/2384-3-0x0000000006750000-0x00000000070D9000-memory.dmp

    Filesize

    9.5MB

  • memory/2384-4-0x00000000060A0000-0x0000000006147000-memory.dmp

    Filesize

    668KB

  • memory/2384-7-0x00000000060A0000-0x0000000006147000-memory.dmp

    Filesize

    668KB

  • memory/2384-11-0x0000000000730000-0x000000000074D000-memory.dmp

    Filesize

    116KB

  • memory/2384-12-0x0000000000F44000-0x0000000000F45000-memory.dmp

    Filesize

    4KB

  • memory/2384-8-0x0000000000730000-0x000000000074D000-memory.dmp

    Filesize

    116KB